Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-06-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
-
Size
309KB
-
MD5
cdd0ddbd896f51d1b1bf6623e0a0210d
-
SHA1
83bc6e909e11f557dc4505a8f99ed9d72ba18c6b
-
SHA256
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f
-
SHA512
66c5f196297ee8fcd31bb3ad4594828f052053e83dd09c03372cade69f62cc511c857aec204ae9fe60b4a80733053a3819d83c262d79d391e79b8980870d4e40
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exedescription pid process target process PID 4328 set thread context of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exepid process 3260 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 3260 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 2480 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2480 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exepid process 3260 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exedescription pid process target process PID 4328 wrote to memory of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe PID 4328 wrote to memory of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe PID 4328 wrote to memory of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe PID 4328 wrote to memory of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe PID 4328 wrote to memory of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe PID 4328 wrote to memory of 3260 4328 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe 77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe"C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe"C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3260-130-0x0000000000000000-mapping.dmp
-
memory/3260-131-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3260-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3260-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4328-132-0x0000000000CCD000-0x0000000000CDD000-memory.dmpFilesize
64KB
-
memory/4328-133-0x0000000000C90000-0x0000000000C99000-memory.dmpFilesize
36KB